Blame heartbleed for the practice, which long predates ChatGPT and vibecoding. Human psychology is to blame. Only nerds are going to find CVE-2014-0160 triggering, but if I say heartbleed everyone who was there remembers.

> Only nerds are going to find CVE-2014-0160 triggering, but if I say heartbleed everyone who was there remembers.

That has more to do with the severity of heartbleed than the fact that it had a name and a logo. I've since seen a lot of vulnerabilities try to market themselves with websites, cute names, and stupid logos but I still don't remember them because they still just weren't big enough to actually be memorable.

yes, the other day I remembered "that dirty page bug with AF_ALG" and apparently it's got a name, but I could've found its CVE number just as well

Why? I like the presentation.

agreed, we should all use gopher and block all web traffic, go back to text based systems, use single threaded operating systems and use token ring NIC's

I'll be honest, I have no idea what gopher or ring NIC is, lol.

Ah before www, gopher was used to try arrange information, similar to this page. Prior to that there were bbs’s where you dialed up to another computer.

I think it's a good idea when there is no CVE and a don't fix status.

Before this practice in general you simply released the exploit and see if enough chaos triggers a fix.

If people can't be responsible, let's just create a mailing list, call it "full-disclosure" and post everything there.

For those following along at home: https://nmap.org/mailman/listinfo/fulldisclosure

why not? If you don't like it don't click it. Is not that the main purpose of the web that everybody can publish a web site?

Well, to be fair, you don't know it is until after you've gotten there. But also to be fair the other way, you can just click the close tab and move on with your life. But again to the other side, it sucks when N% of HN articles end up being closed within 2 seconds as you realize the author spent about 4 seconds writing a prompt and is now asking you to spend 5 minutes reading what they likely didn't even review themselves before hitting publish.

A bit like the postal system. Yes, it's meant to send physical letters and what not to my home, but it still sucks when I get ads that just goes straight into the trash. Yes, you're using the system as intended, but I still consider your business slop if you send ads to me this way.

Sounds like a you problem, I’m just sharing information that’ll hopefully force Google’s hand in fixing a bug.

Not if it helps raise awareness and gets companies to notice. Is peanutbutterjelly.co.uk more worthy of a domain ?

I hear that, but if the vendor closes as won't fix you don't really have another option to get the vendor to pay attention.

Putting up a website is as easy as writing a blog post now. Why wouldn't they?